Windows Embedded

New Windows Embedded Tool: Driver Injector: http://wunger.wordpress.com/

The Windows® Automated Installation Kit (AIK) for Windows® 7:

http://www.microsoft.com/download/en/confirmation.aspx?id=5753

Einstieg in Microsofts Windows Embedded Standard 7:

http://www.elektronikpraxis.vogel.de/themen/embeddedsoftwareengineering/implementierung/articles/264977/

JavaCard Interesting Threads

https://forums.oracle.com/forums/thread.jspa?threadID=1749204

https://forums.oracle.com/forums/thread.jspa?threadID=1749464

Minidriver

The following source is based on PKCS#15

http://www.opensc-project.org/opensc/browser/OpenSC/src/minidriver/minidriver.c

How to get it signed?

http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/sc-minidriver_certreqs_v6.docx

Overview article:

http://www.opensc-project.org/opensc/wiki/MiniDriver

No Serial Number in JavaCard Applet

There is no current standardized method to get the serial number of the smart card chip into the applet.

Although some implementations offer proprietary methods to get e.g. CPLC data, it is not available in the install method (see also this link) and not part of the JavaCard specification. Why is this essential feature missing?

UHF Labels with Computing Capacity

It can be observed that new developments are under progress embedding cryptographic computing power into passive RFID UHF chips (e.g. https://www-eng.llnl.gov/sens_img_comm/sens_img_comm_rfid.html). So far passive UHF labels were only used to transmit the id and at maximum store some bytes. Now new prototypes are under development offering true cryptographic challenge – response authentication. Although right now the distance for the strong authentication is limited this is an interesting step into the right direction….

Legic prime and PC/SC

Why is there no reader available on the market reading Legic prime MIM 256 or MIM 1024 serial numbers and provide them via PC/SC interface? Some (quite expensive) USB and serial readers with proprietary interface do exist – but none of them offers a PC/SC compliant Windows driver (signed or unisgned) to issue a “Get UID command” via standard smartcard software (FF CA 00 00 00).

NDA vs. Kerckhoff

It is ridiculous to make an NDA for basic functionality of a product like it is done for most of smartcard operating system interface specifications!

The security of a smart card OS must not rely on the confidentiality of an unrestricted interface to the outside world.

Nevertheless this procedure is typically requested by security evaluators. Which leaves even more doubts …

Windows Minidriver Setup for XP

To upgrade a XP system to the new card module / minidriver architecture from MS:

http://support.microsoft.com/kb/909520/en-us

This will allow you to use the “Microsoft Base Smart Card Crypto Provider”

ATR List

The best ATR list on the web: http://ludovic.rousseau.free.fr/softwares/pcsc-tools/smartcard_list.txt

Smartcard Security General Consideration

There is nothing like security. Security is just another word for the budget of the attacker.

This general statement also applies to smart cards.

Common Criteria, ITSEC, FIPS … no guarantee to withstand a professional hacking attempt.

By the way: a security evaluation typically does not reveal bugs in the operating system!